CVE-2020-8903
Priviged Escalation in Google Cloud Platform's Guest-OSLogin
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Priviged Escalation in Google Cloud Platform's Guest-OSLogin
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.
- Record
CVE-2020-8903- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2020-29742
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.
- Record
EUVD-2020-29742- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-29mh-jw46-2rf9
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507...
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.
- Record
GHSA-29mh-jw46-2rf9- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
NVD
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.
- Record
CVE-2020-8903- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-276
- Updated
- 2026-11-02
OSV
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.
- Record
CVE-2020-8903- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8903
A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "adm" group, users with this role are able to read the DHCP XID from the systemd journal. Using the DHCP XID, it is then possible to set the IP address and hostname of the instance to any value, which is then stored in /etc/hosts. An attacker can then point metadata.google.internal to an arbitrary IP address and impersonate the GCE metadata server which make it is possible to instruct the OS Login PAM module to grant administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "adm" user from the OS Login entry.
- Record
UBUNTU-CVE-2020-8903- CVSS 4.0
- 7.3 High
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2020:0996-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
-
Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978)
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258) This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0996-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1014-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
-
Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978)
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258)
- Record
openSUSE-SU-2020:1014-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:1934-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
-
Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978)
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258)
- Record
SUSE-SU-2020:1934-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2200-1 No score
Security update for google-compute-engine
This update for google-compute-engine fixes the following issues:
- Do not add the created user to the adm (CVE-2020-8903), docker (CVE-2020-8907), or lxd (CVE-2020-8933) groups if they exist (bsc#1173258).
- Don't enable and start google-network-daemon.service when it's already installed (bsc#1169978).
- Record
SUSE-SU-2020:2200-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
google-compute-engineSUSE:Linux Enterprise Module for Public Cloud 15 SP1 From an advisory covering 3 CVEs |
before 20190801-4.38.1 | 20190801-4.38.1 |
google-compute-engineSUSE:Linux Enterprise Module for Public Cloud 15 SP2 From an advisory covering 3 CVEs |
before 20190801-4.38.1 | 20190801-4.38.1 |
google-compute-engineSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 20190801-54.1 | 20190801-54.1 |
gce-compute-image-packagesUbuntu:14.04:LTS |
All versions, plus listed versions 20160930-0ubuntu3~14.04.020160930-0ubuntu3~14.04.120160930-0ubuntu3~14.04.220160930-0ubuntu6~14.04.020170426-0ubuntu2~14.04.0 Show 12 moreShow less20170523-0ubuntu1~14.04.020170622-0ubuntu1~14.04.020170718-0ubuntu1~14.04.020171019+dfsg1-0ubuntu1~14.04.020171025+dfsg1-0ubuntu1~14.04.020171129+dfsg1-0ubuntu1~14.04.020180129+dfsg1-0ubuntu1~14.04.020180510+dfsg1-0ubuntu3~14.04.320180905+dfsg1-0ubuntu1~14.04.020180905+dfsg1-0ubuntu1~14.04.120190124+dfsg1-0ubuntu1~14.04.020190315-0ubuntu1~14.04.0 |
None known |
gce-compute-image-packagesUbuntu:16.04:LTS |
before 20190801-0ubuntu1~16.04.1, plus listed versions 20160930-0ubuntu3~16.04.020160930-0ubuntu5~16.04.020160930-0ubuntu6~16.04.020170426-0ubuntu2~16.04.020170523-0ubuntu1~16.04.0 Show 13 moreShow less20170622-0ubuntu1~16.04.020170718-0ubuntu1~16.04.020171019+dfsg1-0ubuntu1~16.04.020171025+dfsg1-0ubuntu1~16.04.020171129+dfsg1-0ubuntu1~16.04.020180129+dfsg1-0ubuntu1~16.04.020180510+dfsg1-0ubuntu3~16.04.020180510+dfsg1-0ubuntu3~16.04.120180905+dfsg1-0ubuntu1~16.04.020180905+dfsg1-0ubuntu1~16.04.120190124+dfsg1-0ubuntu1~16.04.020190522-0ubuntu1~16.04.020190801-0ubuntu1~16.04.0 |
20190801-0ubuntu1~16.04.1 |
gce-compute-image-packagesUbuntu:18.04:LTS |
before 20190801-0ubuntu1~18.04.1, plus listed versions 20171006+dfsg1-0ubuntu120171019+dfsg1-0ubuntu120171025+dfsg1-0ubuntu120171129+dfsg1-0ubuntu120180129+dfsg1-0ubuntu1 Show 8 moreShow less20180129+dfsg1-0ubuntu220180129+dfsg1-0ubuntu320180510+dfsg1-0ubuntu4~18.04.020180510+dfsg1-0ubuntu4~18.04.120180905+dfsg1-0ubuntu1~18.04.020190124+dfsg1-0ubuntu1~18.04.020190522-0ubuntu1~18.04.020190801-0ubuntu1~18.04.0 |
20190801-0ubuntu1~18.04.1 |
gce-compute-image-packagesUbuntu:20.04:LTS |
before 20190801-0ubuntu4.1, plus listed versions 20190801-0ubuntu120190801-0ubuntu220190801-0ubuntu320190801-0ubuntu4 |
20190801-0ubuntu4.1 |
google-compute-engineopenSUSE:Leap 15.1 From an advisory covering 3 CVEs |
before 20190801-lp151.2.25.1 | 20190801-lp151.2.25.1 |
google-compute-engineopenSUSE:Leap 15.2 From an advisory covering 3 CVEs |
before 20190801-lp152.5.4.1 | 20190801-lp152.5.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8903 is a high vulnerability (CVSS 7.3) in Google Guest-oslogin, published June 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in gce-compute-image-packages 20190801-0ubuntu1~16.04.1.
References
github.com/GoogleCloudPlatform/guest-oslogin/pull/29
gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020
cloud.google.com/support/bulletins
lists.opensuse.org/opensuse-security-announce/2020-07/msg00037.html
nvd.nist.gov/vuln/detail/CVE-2020-8903
Show 12 moreShow less
suse.com/support/update/announcement/2020/suse-su-20201934-1
bugzilla.suse.com/1169978
ubuntu.com/security/CVE-2020-8903
cve.org/CVERecord?id=CVE-2020-8903